A developer needs to deploy code to the staging environment but should not have permission to deploy to production. What is the best way to achieve this?

Grant the developer the Owner role on the project.

Create a custom IAM role that includes deployment permissions only for staging resources.

Give the developer the Cloud Build Editor role.

Add the developer to a group that has Editor role on the project.

In a CI/CD pipeline, what is the purpose of adding a vulnerability scanning step that fails the build if critical vulnerabilities are found?

To prevent vulnerable artifacts from being deployed.

To ensure the build is fast and efficient.

To provide a report for auditors only.

To automatically fix the vulnerabilities.

A DevOps team wants to ensure that the container images they deploy have not been tampered with after being built. Which practice best supports this?

Using a unique tag for each build.

Storing images in a private registry.

Scanning images for vulnerabilities.

Signing the images and verifying signatures before deployment.

What is the primary function of Binary Authorization in a Google Cloud environment?

To encrypt container images at rest.

To enforce deployment policies by requiring container images to be signed by trusted authorities.

To scan container images for vulnerabilities.

To manage access to container registries.

A security team wants to understand the risk of a container image before deployment. They use Artifact Analysis and see a list of vulnerabilities with different severity levels. What is the most important factor to consider when interpreting these findings?

The number of vulnerabilities in the image

The severity of each vulnerability and whether it is exploitable

Google CloudProfessional Cloud DevOps Engineer

Domain 2Objective 4

2.4 Securing the Deployment Pipeline PROFESSIONAL-CLOUD-DEVOPS-ENGINEER Practice Questions (Page 1)

Part of the Section 2: Building and implementing CI/CD pipelines, including continuous testing, for application, infrastructure, and machine learning workloads domain, which accounts for ~25% of the exam of the PROFESSIONAL-CLOUD-DEVOPS-ENGINEER exam.

15questions here

3free pages

7concepts

~25% of the examof the exam

Questions 1–5

1foundation · easy
A developer needs to deploy code to the staging environment but should not have permission to deploy to production. What is the best way to achieve this?
Select an answer first
2foundation · easy
In a CI/CD pipeline, what is the purpose of adding a vulnerability scanning step that fails the build if critical vulnerabilities are found?
Select an answer first
3foundation · easy
A DevOps team wants to ensure that the container images they deploy have not been tampered with after being built. Which practice best supports this?
Select an answer first
4foundation · easy
What is the primary function of Binary Authorization in a Google Cloud environment?
Select an answer first
5foundation · easy
A security team wants to understand the risk of a container image before deployment. They use Artifact Analysis and see a list of vulnerabilities with different severity levels. What is the most important factor to consider when interpreting these findings?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to PROFESSIONAL-CLOUD-DEVOPS-ENGINEER

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Google Cloud. “PROFESSIONAL-CLOUD-DEVOPS-ENGINEER” is a trademark of its owner, used for identification only.